tOS MP3 Decoder — Out-of-Bounds Read via Unbounded Region Address
In the MP3 decoder of mp3_decoder.c, a raw 5-bit region-address field (value range 0-31) read directly from an MP3 frame's side-information bytes is used as an index into the 16-entry ra1tab lookup table without any bounds check, unlike the equivalent tsel < 16 guard already applied a few lines later for the big_htable/linbits_tbl lookups. A crafted MP3 frame with a region_address value of 16 or greater causes an out-of-bounds read past the end of the table, whose resulting garbage value also influences how many Huffman-coded coefficients are subsequently decoded. This is reachable simply by playing an attacker-supplied .mp3 file.
After finding bounds-checking gaps in the AAC and M4A audio decoders in ASI-2026-0005 and ASI-2026-0009, we decided to review the MP3 decoder with the same lens. While reviewing mp3_decoder.c, we noticed an interesting asymmetry: the same function already applies a tsel < 16 guard for the big_htable/linbits_tbl lookups a few lines later, but no equivalent check existed for the preceding ra1tab lookup.
A raw 5-bit region-address field (value range 0-31), read directly from an MP3 frame's side-information bytes, was used as an index into the 16-entry ra1tab lookup table with no bounds check at all. This stood in contrast to the equivalent tsel < 16 guard already applied a few lines later in the same function for the big_htable/linbits_tbl lookups — the check existed in one place but not the other.
An attacker crafts a malicious .mp3 file containing a frame whose side information sets region_address to 16 or greater. When the victim attempts to play this file, an out-of-bounds read occurs past the end of the ra1tab table. The resulting garbage value also influences how many Huffman-coded coefficients are subsequently decoded, meaning the fault can propagate beyond the initial read into later stages of decoding. Triggering this requires nothing more than attempting to play the malicious file.
A 5-bit region-address field taken directly from the frame's side information (range 0-31) was used to index the 16-entry ra1tab[] table without the same bounds check already applied to the sibling big_htable/linbits_tbl lookups elsewhere in the same function.
The index is now masked to 4 bits before use, keeping it within the table's valid 0-15 range regardless of the raw bitstream value.
CWE-125, CWE-129
Artfical DT Developer Talha Berk Arslan